CVE-2026-54284

Name of the Vulnerable Software and Affected Versions sqlparse versions prior to 0.6.0

Description sqlparse contains an issue where the construction of TokenList and subsequent string conversion repeatedly flatten nested token subtrees. This occurs when processing SQL with deep nesting, such as numerous parentheses or CASE WHEN chains, leading to quadratic CPU consumption. This behavior can be triggered via the sqlparse.parse(), sqlparse.format(), and sqlparse.split() functions. Even when internal depth and token limits are reached, the process of reaching those limits is superlinear, allowing a small malicious payload (e.g., 1-2 KB) to consume significant CPU resources for several seconds, potentially leading to a denial of service by exhausting available worker processes.

Recommendations Update sqlparse to version 0.6.0 or later.